{"action":"created","issue":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/2192","repository_url":"https://api.github.com/repos/yarnpkg/yarn","labels_url":"https://api.github.com/repos/yarnpkg/yarn/issues/2192/labels{/name}","comments_url":"https://api.github.com/repos/yarnpkg/yarn/issues/2192/comments","events_url":"https://api.github.com/repos/yarnpkg/yarn/issues/2192/events","html_url":"https://github.com/yarnpkg/yarn/issues/2192","id":194336251,"number":2192,"title":"When installing global modules, Yarn tries to create .cmd file in wrong directory","user":{"login":"gaearon","id":810438,"avatar_url":"https://avatars.githubusercontent.com/u/810438?v=3","gravatar_id":"","url":"https://api.github.com/users/gaearon","html_url":"https://github.com/gaearon","followers_url":"https://api.github.com/users/gaearon/followers","following_url":"https://api.github.com/users/gaearon/following{/other_user}","gists_url":"https://api.github.com/users/gaearon/gists{/gist_id}","starred_url":"https://api.github.com/users/gaearon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gaearon/subscriptions","organizations_url":"https://api.github.com/users/gaearon/orgs","repos_url":"https://api.github.com/users/gaearon/repos","events_url":"https://api.github.com/users/gaearon/events{/privacy}","received_events_url":"https://api.github.com/users/gaearon/received_events","type":"User","site_admin":false},"labels":[{"id":313603437,"url":"https://api.github.com/repos/yarnpkg/yarn/labels/bug","name":"bug","color":"fc2929","default":true},{"id":459474536,"url":"https://api.github.com/repos/yarnpkg/yarn/labels/windows","name":"windows","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":26,"created_at":"2016-12-08T13:30:47Z","updated_at":"2017-02-22T16:52:25Z","closed_at":null,"body":"**What is the current behavior?**\r\n\r\nYarn fails to install `create-react-app`:\r\n\r\n```\r\nC:\\Users\\gaearon>yarn global add create-react-app\r\nyarn global v0.17.10\r\n[1/4] Resolving packages...\r\n[2/4] Fetching packages...\r\n[3/4] Linking dependencies...\r\n[4/4] Building fresh packages...\r\nsuccess Installed create-react-app@1.0.0 with binaries:\r\n      - create-react-app\r\nerror An unexpected error occurred: \"EPERM: operation not permitted, open 'C:\\\\Program Files\\\\nodejs\\\\create-react-app.cmd'\".\r\ninfo If you think this is a bug, please open a bug report with the information provided in \"C:\\\\Users\\\\gaearon\\\\AppData\\\\Local\\\\Yarn\\\\config\\\\global\\\\yarn-error.log\".\r\ninfo Visit https://yarnpkg.com/en/docs/cli/global for documentation about this command.\r\n```\r\n\r\nI have no such problem with npm:\r\n\r\n```\r\nC:\\Users\\gaearon> npm i -g create-react-app\r\nC:\\Users\\gaearon\\AppData\\Roaming\\npm\\create-react-app -> C:\\Users\\gaearon\\AppData\\Roaming\\npm\\node_modules\\create-react-app\\index.js\r\nC:\\Users\\gaearon\\AppData\\Roaming\\npm\r\n`-- create-react-app@1.0.0\r\n  ...\r\n```\r\n\r\n**If the current behavior is a bug, please provide the steps to reproduce.**\r\n\r\n```\r\nyarn global add create-react-app\r\n```\r\n\r\n**What is the expected behavior?**\r\n\r\nIt gets installed.\r\n\r\n**Please mention your node.js, yarn and operating system version.**\r\n\r\nNode 6.9.2\r\nYarn 0.17.10\r\nWindows 10 Enterprise 10.0.14393 Build 14393\r\n\r\n**Yarn log**\r\n\r\nhttps://gist.github.com/gaearon/e67437d7a4102fe696a34dec2c7fe825\r\n"},"comment":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/comments/281729278","html_url":"https://github.com/yarnpkg/yarn/issues/2192#issuecomment-281729278","issue_url":"https://api.github.com/repos/yarnpkg/yarn/issues/2192","id":281729278,"user":{"login":"dcu-sharepoint","id":22737071,"avatar_url":"https://avatars.githubusercontent.com/u/22737071?v=3","gravatar_id":"","url":"https://api.github.com/users/dcu-sharepoint","html_url":"https://github.com/dcu-sharepoint","followers_url":"https://api.github.com/users/dcu-sharepoint/followers","following_url":"https://api.github.com/users/dcu-sharepoint/following{/other_user}","gists_url":"https://api.github.com/users/dcu-sharepoint/gists{/gist_id}","starred_url":"https://api.github.com/users/dcu-sharepoint/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcu-sharepoint/subscriptions","organizations_url":"https://api.github.com/users/dcu-sharepoint/orgs","repos_url":"https://api.github.com/users/dcu-sharepoint/repos","events_url":"https://api.github.com/users/dcu-sharepoint/events{/privacy}","received_events_url":"https://api.github.com/users/dcu-sharepoint/received_events","type":"User","site_admin":false},"created_at":"2017-02-22T16:52:25Z","updated_at":"2017-02-22T16:52:25Z","body":"bold was not available as an option on an email message which is what I answered to...\n\n\nThanks\n\n\n\n________________________________\nFrom: Daniel Lo Nigro <notifications@github.com>\nSent: Wednesday, February 22, 2017 12:17 AM\nTo: yarnpkg/yarn\nCc: L. Carlos Rodriguez; Mention\nSubject: Re: [yarnpkg/yarn] When installing global modules, Yarn tries to create .cmd file in wrong directory (#2192)\n\n\n@dcu-sharepoint<https://github.com/dcu-sharepoint>, please avoid using excessive capital letters. You can make text bold if you write your comments on GitHub rather than via email :)\n\nESPECIALLY WHEN THE INSTALL PUTS THESE FILE WITHOUT ANY WARNING NOR DOES IT REQUEST PERMISSION WHEN THEY ARE INSTALLED EVEN THOUGH THE ACCOUNT BEING USED TO INSTALL THESE FILES IS A NON-ADMIN ACCOUNT AND WITHOUT PERMISSION TO TOUCH/INSTALL/DELETE/REMOVE/ADD ANYTHING TO THE SYSTEM FILES.\n\n@dcu-sharepoint<https://github.com/dcu-sharepoint> - There's no way to bypass Windows' directory permissions... It's likely that the Node.js directory is writable for your user or something similar, or you're running your command prompt as administrator. Alternatively, UAC File Virtualization (eg. https://blogs.msdn.microsoft.com/oldnewthing/20150902-00/?p=91681) could be kicking in and the files may actually be going to %LocalAppData%\\VirtualStore\\Program Files (x86).\n\nIt's by design, and Yarn does not change this behavior by default since most users consider installing arbitrary packages a feature.\n\n@gaearon<https://github.com/gaearon> - It's a pretty bad design choice IMO, and I'm hoping that we get proper integrity verification for packages in the future. People tend to go for convenience rather than security, which isn't always the best tradeoff. This is one of the major reasons why every installation method for Yarn (tarball/installer, Debian/Ubuntu package, Windows installer) has integrity verification of some sort. The tarball and Debian package are signed using GPG< and the Windows installer has an Authenticode signature.\n\n—\nYou are receiving this because you were mentioned.\nReply to this email directly, view it on GitHub<https://github.com/yarnpkg/yarn/issues/2192#issuecomment-281572097>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AVrwr40rC8jnWMvJc4EMFPVQ94j9MlbRks5re8T-gaJpZM4LH0dc>.\n"}}
{"actor":{"display_login":"dcu-sharepoint"}}